hdbfuzzer -面向目标的混合定向二进制模糊器

Yingchao Yu, Xiaojun Qin, Shuitao Gan
{"title":"hdbfuzzer -面向目标的混合定向二进制模糊器","authors":"Yingchao Yu, Xiaojun Qin, Shuitao Gan","doi":"10.1145/3487075.3487124","DOIUrl":null,"url":null,"abstract":"In this paper, we propose a target-oriented hybrid directed binary fuzzer (HDBFuzzer) to solve the vulnerability confirmation problem based on binary code similarity comparison. HDBFuzzer combines macro function level direction fuzzing and micro path-constraint directed solving. For some branches with simple or loose constraints, it still uses directed mutation of the directed fuzzing to penetrate while for some really hard-to-penetrate constraints, it resorts to guided concolic execution. At the same time, in order to improve the efficiency of constraint solving, we propose a constraint solving method based on “path abstraction”, which approximates the solution space by the linear expression and generates effective input utilizing the highly-effective sampling method towards the linear space. Then, under the guidance by the directed greybox fuzzing, HDBFuzzer can generate input that can quickly reach the vulnerable code region and finally crash the program under the test to confirm the vulnerability hidden in the binary program. We evaluate HDBFuzzer against AFLGo-B and QSYM on LAVA-M dataset and ten real-world programs, and the results show that HDBFuzzer is superior to AFLGo-B and QSYM on the bug discovery, bug reproduction and target reaching capabilities.","PeriodicalId":354966,"journal":{"name":"Proceedings of the 5th International Conference on Computer Science and Application Engineering","volume":"15 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2021-10-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"1","resultStr":"{\"title\":\"HDBFuzzer–Target-oriented Hybrid Directed Binary Fuzzer\",\"authors\":\"Yingchao Yu, Xiaojun Qin, Shuitao Gan\",\"doi\":\"10.1145/3487075.3487124\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"In this paper, we propose a target-oriented hybrid directed binary fuzzer (HDBFuzzer) to solve the vulnerability confirmation problem based on binary code similarity comparison. HDBFuzzer combines macro function level direction fuzzing and micro path-constraint directed solving. For some branches with simple or loose constraints, it still uses directed mutation of the directed fuzzing to penetrate while for some really hard-to-penetrate constraints, it resorts to guided concolic execution. At the same time, in order to improve the efficiency of constraint solving, we propose a constraint solving method based on “path abstraction”, which approximates the solution space by the linear expression and generates effective input utilizing the highly-effective sampling method towards the linear space. Then, under the guidance by the directed greybox fuzzing, HDBFuzzer can generate input that can quickly reach the vulnerable code region and finally crash the program under the test to confirm the vulnerability hidden in the binary program. We evaluate HDBFuzzer against AFLGo-B and QSYM on LAVA-M dataset and ten real-world programs, and the results show that HDBFuzzer is superior to AFLGo-B and QSYM on the bug discovery, bug reproduction and target reaching capabilities.\",\"PeriodicalId\":354966,\"journal\":{\"name\":\"Proceedings of the 5th International Conference on Computer Science and Application Engineering\",\"volume\":\"15 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2021-10-19\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"1\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Proceedings of the 5th International Conference on Computer Science and Application Engineering\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1145/3487075.3487124\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Proceedings of the 5th International Conference on Computer Science and Application Engineering","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/3487075.3487124","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 1

摘要

为了解决基于二进制代码相似度比较的漏洞确认问题,本文提出了一种面向目标的混合定向二进制模糊器(HDBFuzzer)。HDBFuzzer结合了宏观功能级方向模糊和微观路径约束定向求解。对于一些具有简单或松散约束的分支,它仍然使用定向模糊的定向突变来渗透,而对于一些非常难以渗透的约束,它采用引导结肠执行。同时,为了提高约束求解的效率,我们提出了一种基于“路径抽象”的约束求解方法,该方法通过线性表达式逼近解空间,并利用高效采样方法对线性空间产生有效输入。然后,在定向灰盒模糊测试的指导下,HDBFuzzer生成能够快速到达脆弱代码区域的输入,最终使被测程序崩溃,从而确认二进制程序中隐藏的漏洞。在LAVA-M数据集和10个实际应用程序上对HDBFuzzer与AFLGo-B和QSYM进行了比较,结果表明HDBFuzzer在bug发现、bug再现和目标到达能力上优于AFLGo-B和QSYM。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
HDBFuzzer–Target-oriented Hybrid Directed Binary Fuzzer
In this paper, we propose a target-oriented hybrid directed binary fuzzer (HDBFuzzer) to solve the vulnerability confirmation problem based on binary code similarity comparison. HDBFuzzer combines macro function level direction fuzzing and micro path-constraint directed solving. For some branches with simple or loose constraints, it still uses directed mutation of the directed fuzzing to penetrate while for some really hard-to-penetrate constraints, it resorts to guided concolic execution. At the same time, in order to improve the efficiency of constraint solving, we propose a constraint solving method based on “path abstraction”, which approximates the solution space by the linear expression and generates effective input utilizing the highly-effective sampling method towards the linear space. Then, under the guidance by the directed greybox fuzzing, HDBFuzzer can generate input that can quickly reach the vulnerable code region and finally crash the program under the test to confirm the vulnerability hidden in the binary program. We evaluate HDBFuzzer against AFLGo-B and QSYM on LAVA-M dataset and ten real-world programs, and the results show that HDBFuzzer is superior to AFLGo-B and QSYM on the bug discovery, bug reproduction and target reaching capabilities.
求助全文
通过发布文献求助,成功后即可免费获取论文全文。 去求助
来源期刊
自引率
0.00%
发文量
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信